{"record":{"id":"2ed6d3b4e6a858a4","repo":"thanos-io/thanos","slug":"setup-grpc-server","errorCode":null,"errorMessage":"setup gRPC server","messagePattern":"setup gRPC server","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/thanos/query.go","lineNumber":624,"sourceCode":"\t\t)\n\t\tsrv.Handle(\"/\", router)\n\n\t\tg.Add(func() error {\n\t\t\tstatusProber.Healthy()\n\n\t\t\treturn srv.ListenAndServe()\n\t\t}, func(err error) {\n\t\t\tstatusProber.NotReady(err)\n\t\t\tdefer statusProber.NotHealthy(err)\n\n\t\t\tsrv.Shutdown(err)\n\t\t})\n\t}\n\t// Start query (proxy) gRPC StoreAPI.\n\t{\n\t\ttlsCfg, err := tls.NewServerConfig(log.With(logger, \"protocol\", \"gRPC\"), grpcServerConfig.tlsSrvCert, grpcServerConfig.tlsSrvKey, grpcServerConfig.tlsSrvClientCA, grpcServerConfig.tlsMinVersion, grpcServerConfig.tlsCiphers, grpcServerConfig.tlsCurves)\n\t\tif err != nil {\n\t\t\treturn errors.Wrap(err, \"setup gRPC server\")\n\t\t}\n\n\t\tinfoSrv := info.NewInfoServer(\n\t\t\tcomponent.Query.String(),\n\t\t\tinfo.WithLabelSetFunc(func() []labelpb.ZLabelSet { return proxyStore.LabelSet() }),\n\t\t\tinfo.WithStoreInfoFunc(func() (*infopb.StoreInfo, error) {\n\t\t\t\tif httpProbe.IsReady() {\n\t\t\t\t\tmint, maxt := proxyStore.TimeRange()\n\t\t\t\t\treturn &infopb.StoreInfo{\n\t\t\t\t\t\tMinTime:                      mint,\n\t\t\t\t\t\tMaxTime:                      maxt,\n\t\t\t\t\t\tSupportsSharding:             true,\n\t\t\t\t\t\tSupportsWithoutReplicaLabels: true,\n\t\t\t\t\t\tTsdbInfos:                    proxyStore.TSDBInfos(),\n\t\t\t\t\t}, nil\n\t\t\t\t}\n\t\t\t\treturn nil, errors.New(\"Not ready\")\n\t\t\t}),","sourceCodeStart":606,"sourceCodeEnd":642,"githubUrl":"https://github.com/thanos-io/thanos/blob/35b8b991177def87ed52dcf10f9b6d87f07282c8/cmd/thanos/query.go#L606-L642","documentation":"In runQuery's gRPC server setup block, tls.NewServerConfig builds the server TLS configuration from --grpc-server-tls-cert, --grpc-server-tls-key, and --grpc-server-tls-client-ca; any failure (unreadable files, bad PEM, invalid CA, unsupported min version/cipher/curve names) is wrapped as \"setup gRPC server\".","triggerScenarios":"Calling `thanos query` with any of the TLS gRPC server flags set while the referenced cert/key/CA files are missing, unreadable, not valid PEM, or the --grpc-server-tls-min-version/ciphers/curves values are unrecognized.","commonSituations":"Kubernetes secret mounted at a different path than the flag, cert files with wrong permissions, expired/reformatted certificates, or typo'd cipher-suite names.","solutions":["Verify the cert, key, and client-CA file paths exist and are readable by the Thanos process.","Check the files are valid PEM (openssl x509 -in cert -noout).","Validate --grpc-server-tls-min-version, ciphers, and curves against supported values (e.g. TLS12).","If TLS is not needed, remove the TLS flags entirely.","Check mounted secret names/paths in your deployment manifest."],"exampleFix":"// before\n--grpc-server-tls-cert=/etc/certs/server.crt  // wrong mount path\n// after\n--grpc-server-tls-cert=/etc/thanos/tls/server.crt","handlingStrategy":"validation","validationCode":"for _, f := range []string{certPath, keyPath, caPath} {\n    if f == \"\" { continue }\n    fi, err := os.Stat(f)\n    if err != nil || fi.IsDir() {\n        return fmt.Errorf(\"TLS file missing: %s\", f)\n    }\n    if b, err := os.ReadFile(f); err != nil || !bytes.Contains(b, []byte(\"-----BEGIN\")) {\n        return fmt.Errorf(\"TLS file not PEM: %s\", f)\n    }\n}","typeGuard":null,"tryCatchPattern":"if _, err := tls.NewServerConfig(logger, cert, key, ca, \"\", \"\", \"\"); err != nil {\n    return fmt.Errorf(\"TLS setup failed: %w\", err)\n}","preventionTips":["Mount TLS secrets at fixed paths and verify them in an initContainer","Validate certs with openssl before rollout","Use only documented values for min-version/ciphers/curves","Ensure the Thanos user has read permission on key files"],"tags":["tls","grpc","configuration"],"backgroundTag":"file-not-found","analyzedSha":"35b8b991177def87ed52dcf10f9b6d87f07282c8","analyzedAt":"2026-09-07T01:49:59.689Z","contentChangedAt":"2026-09-07T01:49:59.689Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}